import re

s = """\
178.238.238.221 - - [18/Nov/2019:03:53:50 +0800] "GET / HTTP/1.0" 502 173 "-" "masscan/1.0 (https://github.com/robertdavidgraham/masscan)" "-"
"""

regx = re.compile("(?P<ip>([\d]+\.){3}\d+) - - \[.+ .+\] \"\w+ (?P<remote>\S+) .+\"")
match = regx.match(s)
print(match)
print(match.group('ip'), match.group('remote'))

origin_ip_dict = {}
origin_remote_dict = {}

with open("access.log-20191119") as f:
    for line in f:
        # print(line)
        match = regx.match(line)
        if match:
            ip = match.group('ip')
            remote = match.group('remote')

        origin_ip_dict[ip] = origin_ip_dict.get(ip, 0) + 1
        origin_remote_dict[remote] = origin_remote_dict.get(remote, 0) + 1


for rank, item in enumerate(sorted(origin_ip_dict.items(), key=lambda item: item[1], reverse=True)[:10], 1):
    print("{:<2}>>>>>>>{}".format(rank, item))

print()
for rank, item in enumerate(sorted(origin_remote_dict.items(), key=lambda item: item[1], reverse=True)[:10], 1):
    print("{:<2}>>>>>>>{}".format(rank, item))

    # ip匹配是对的，但是url匹配中，对于带参数的情况，例如/index.php?a=1&b=2这样的情况，和/index.php是相同的访问页面
    # 这种特殊的情况容易忽视，可以尝试修改一下代码看看。